diff --git a/modules/iam-bootstrap/bootstrap-2.json b/modules/iam-bootstrap/bootstrap-2.json
index 7bcd9e9e..28bd874f 100644
--- a/modules/iam-bootstrap/bootstrap-2.json
+++ b/modules/iam-bootstrap/bootstrap-2.json
@@ -20,7 +20,6 @@
       "Effect": "Allow",
       "Action": [
         "lambda:CreateFunction",
-        "lambda:TagResource",
         "lambda:GetFunction",
         "lambda:ListVersionsByFunction",
         "lambda:DeleteFunction",
@@ -42,7 +41,9 @@
         "lambda:UpdateCodeSigningConfig",
         "lambda:GetCodeSigningConfig",
         "lambda:GetFunctionCodeSigningConfig",
-        "lambda:DeleteCodeSigningConfig"
+        "lambda:DeleteCodeSigningConfig",
+        "lambda:TagResource",
+        "lambda:ListTags"
       ],
       "Resource": "*"
     },
@@ -60,7 +61,9 @@
       "Action": [
         "cur:PutReportDefinition",
         "cur:DescribeReportDefinitions",
-        "cur:DeleteReportDefinition"
+        "cur:DeleteReportDefinition",
+        "cur:TagResource",
+        "cur:ListTagsForResource"
       ],
       "Resource": [
         "*"